A study reveals that calorie restriction affects genetic mutations differently across tissues and regions of DNA.
Get the latest international news and world events from around the world.
Tiny Atomic Defects Reveal a Quantum Secret Hidden Inside an Unusual Metal
Atomic-scale defects in an unusual metal may offer a new way to control quantum states.
Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses
Learn how NDR network telemetry helps AI-assisted SOCs connect isolated alerts, reconstruct attack timelines, and investigate suspicious activity.
OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections
OpenAI’s compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model’s hidden reasoning out in plain text, security firm Xint has shown.
OpenAI’s reasoning models work through a problem before answering, and the service normally returns only the raw reasoning as an encrypted item the user cannot read. The method got past the protections OpenAI added in August against this kind of reasoning theft. OpenAI confirmed the problem and fixed it on October 23, according to Xint.
Xint ran the technique against gpt-5.6-sol, one of OpenAI’s reasoning models, using math and algorithm puzzles its researchers wrote themselves. The reasoning it pulled out came from those same requests, and Xint did not claim the method could reach another user’s reasoning.
CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
CISA adds two exploited PHP2Shell flaws to its KEV catalog after honeypot tests confirm remote code execution on a single-worker mod_php setup.
PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026–111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code.
PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but applications and HTTP client libraries can turn it on.
The rebuilt packages, numbered 8.5.12–1, 8.4.27–1, 8.3.36–1 and 8.2.35–1, come five days after the October 21 releases that fixed the two PHP2Shell remote code execution flaws. They use the same PHP source, so those fixes stay in place, and they now include Brotli 1.2.1, the fixed version.
Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
Hackers infected 953 online stores with JavaScript loaders hidden in Magento CMS blocks, using bot filtering to evade security scanners.
UCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts
A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, researcher Ovi found. It only reaches people who install one of these tampered copies, spread outside the official app stores, or who run WeChat inside the kit makers’ own container app.
The kit’s Telegram part matches Baohuo, a backdoor that Doctor Web reported in October 2025. Doctor Web found Baohuo in tampered copies of Telegram X, an Android app from Telegram. At the time, the company estimated that more than 58,000 devices were infected.
The Hacker News compared the two reports. Doctor Web’s technical description of Baohuo lists the same code namespace, com.ucreator.tgjar, the same command-and-control (C2) server, and matching command names as Ovi’s analysis.
‘Gheist’ Weaponizes GitHub Tokens to Steal Cloud Secrets
An ongoing attack is abusing compromised GitHub tokens to harvest cloud secrets and credentials from thousands of developer repositories, bringing into focus how compromised developer accounts can provide a gateway into enterprise cloud environments.
Dubbed “Gheist,” the campaign has left more than 13,500 malicious branches — or versions of a project’s code — across more than 850 compromised GitHub accounts, according to a report published over the weekend by Wiz Research.
The campaign affects everything from personal projects to private enterprise repositories, although public repositories are protected by safeguards GitHub introduced in July, according to the report.
Implantable device uses ultrasound to improve drug delivery to the brain
Patients with glioblastoma, an aggressive type of brain tumor, usually undergo surgery to remove the tumor. However, it’s difficult for surgeons to remove all of the cancer cells, and the tumor often recurs.
MIT researchers have now designed an implantable drug-delivery device that they hope could help prevent recurrence of glioblastoma. Their device contains a reservoir that can release drugs over an extended period, along with ultrasound transducers that use sound waves to help drugs spread farther through the brain and bypass the blood-brain barrier.
Such a device could be implanted in the brain during surgery, then gradually release drugs that would help kill the remaining tumor cells. After implantation, a wireless controller can be used to program the exact ultrasound dosages to be delivered, enhancing the reach of the delivered therapy.